Why don't you simply print "$field" inside the file? I guess there's a prefix slash in this variable, which makes ".//something" perfectly valid (duplicated slashes are tolerated) while "./blah-/something" whould fail miserably (unless you've a "blah-" subdirectory, of course).

As a general note you should avoid doing things like this, even if you're dealing with an hidden field - these are no more secure than visible ones. Use tainted mode, and place strict restrictions upon filenames you allow, like:

   $field =~ s/[^\w.-]//g; # keep alpha, num, and "_.-"
   if ($field =~ /([\w.-]+)/) {
      $field = $1;
   }
   else {
      $field = undef;
   }
   # now $field is untainted
[download]

Another advice: use the three-argument open instead of appending filename to the ">" char.

All that said, take a deep look at perldoc perlsec!